Comments of Consumer Reports - In Response to the California Privacy Protection Agency on the Modified Text of Proposed Rules under the California Privacy Rights Act of 2020

Sep 18, 2026

Comments from Consumer Reports address the California Privacy Protection Agency’s CPPA Modified Draft Regulations implementing the California Privacy Rights Act of 2020 (CPRA). The submission argues that revisions overly accommodate businesses, removing protections that previously barred anti-consumer conduct. It specifically critiques changes to § 7004 regarding intent and “dark pattern” assessment, urging a return to prior language. It also recommends restoring removed examples and restating requirements in § 7012 about notice at collection and descriptions of third parties’ practices.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages243

Reading Time10 h 12 min

AccessFree to download

CPPA Public Comment

Background and overall concerns about revised rules

Critique of § 7004 (methods for submitting requests and obtaining consent)

Critique and recommendations regarding removed examples

Recommendations for § 7012 notice at collection

W129 From: Justin Brookman < > Sent: Sunday, November 20, 2022 7:39 PM To: Regulations Subject: CPPA Public Comment Attachments: CPPA regs comments (Nov 2022).pdf WARNING: This message was sent from outside the CA Gov network. Do not open attachments unless you know thesender: Attached please find Consumer Reports's comment on the CPPA's Modified Draft Regulations. *** This e-mail message is intended only for the designated recipient(s) named above . The information contained in this e-mail and any attachments may be confidential or legally privileged . If you are not the intended recipient, you may not review, retain, copy, redistribute or use this e-mail or any attachment for any purpose, or disclose all or any part of its contents . If you have received this e-mail in error, please immediately notify the sender by reply e-mail and permanently delete this e-mail and any attachments from your computer system . *** CCPA_RM1_ 15DAY_0215 W129 Comments of Consumer Reports In Response to the California Privacy Protection Agency on the Modified Text of Proposed Rules under the California Privacy Rights Act of 2020 By Justin Brookman, Director of Technology Policy November 21, 2022 CCPA_RM1_ 15DAY_0216 W129 Consumer Reports 1 appreciates the opportunity to comment on the modified proposed rules (the Modified Draft Regulations) interpreting the California Privacy Rights Act (CPRA) .2 We thank the California Privacy Protection Agency (CPPA) for soliciting input to make the California Consumer Privacy Act (CCPA), 3 as amended by Proposition 24, work for consumers. The Modified Draft Regulations appear to have been changed largely to accommodate businesses who criticized the scope and text of the original Draft Regulations. While the CPPA certainly should consider ease and cost of compliance in promulgating its regulations, the Modified Draft Regulations have swung too far in the wrong direction. By removing certain provisions proscribing anti-consumer practices, the CPPA is signaling that behaviors previously prohibited by those provisions are now legitimate. We urge the CPPA to either undo certain revisions or make further revisions to ensure that the CPRA effectively protects California consumers. § 7004. Requirements for Methods for Submitting CCPA Requests and Obtaining Consumer Consent. We strongly disagree with the new language contained in § 7004(c) replacing “regardless of user intent” with “A business’s intent in designing the interface is not determinative in whether the user interface is a dark pattern, but a factor to be considered.” Setting aside the practical difficulty in proving subjective intent, business intent is never relevant in assessing whether a particular design is deceptive or not. The effect of the pattern on the user is the only relevant consideration. For this reason, intent is typically not an element of consumer protection laws such as federal and state prohibitions on deceptive and unfair business practices. A company’s intent may be a consideration for a regulator in deciding whether to bring an action orin determining the appropriate penalty in a settlement. It is not, however, a relevant consideration in determining whether a legal violation has occurred. We urge the CPPA to revert to the previous langage. We also urge the CPPA to revert the last two examples removed from § 7004(a)(2) and the first example removed from § 7004(a)(4). All three are straightforward examples of 1 Consumer Reports is an independent, nonprofit membership organization that works side by side with consumers to create a fairer, safer, and healthier world. For over 80 years, CR has provided evidence-based product testing and ratings, rigorous research, hard-hitting investigative journalism, public education, and steadfast policy action on behalf of consumers’ interests, including their interest in securing effective privacy protections. Unconstrained by advertising, CR has

FAQs

What is the main purpose of these Consumer Reports comments?

To respond to the CPPA’s Modified Draft Regulations and urge revisions so the CPRA effectively protects California consumers.

How does the submission view the change to § 7004(c) about business intent?

It argues that subjective business intent should not be determinative for whether a user interface is a deceptive dark pattern; the user’s effect is the relevant consideration.

What does the submission recommend regarding § 7012 notice at collection?

It recommends restating § 7012(e)(6), requiring companies to provide notice of specific third parties or describe those third parties’ business practices.

Sep 18, 2026

Uploaded by Oliver Hayes